Skip to content

[REVIEW] Feat: MetaTx/Multicall + Intervention Mechanism + OZ v5#426

Merged
0xNuggan merged 17 commits intodevfrom
review
Apr 12, 2024
Merged

[REVIEW] Feat: MetaTx/Multicall + Intervention Mechanism + OZ v5#426
0xNuggan merged 17 commits intodevfrom
review

Conversation

@marvinkruse
Copy link
Member

@marvinkruse marvinkruse commented Feb 29, 2024

⚠️ This PR merges from review into the dev branch. ⚠️
At the time of creating this PR (until it is merged), the review branch contains the latest state that has received a security review, including the fixes. Anything in review has been reviewed internally, but not received a security review. We are merging into dev as the current dev branch is still pending the finalization of the audit.


➡️ Process
This PR will receive an external security review. Additionally, at least one of our developers will review it as well, ideally someone who didn't work on it. Please raise any findings/questions directly within this PR, either as a code comment, referencing the corresponding line or as a general comment to the discussion. Please mark comments that are resolved as resolved.


📋 Contents
This PR contains...

  • MetaTx and Multicall support (PR)
  • Update to OpenZeppelin v5 (PR)
  • Adds first Intervention Mechanisms (PR)

Zitzak and others added 9 commits February 6, 2024 14:20
* chore: update OZ lib to V5

* chore: update openzeppelin to v5

- updated paths were needed
- added constructor arguments for Ownable update
- updated OZErrors and the expectRevert that were using them to work with
custom errors
- replaces Address.isContract with the logic it used, as it has been removed

* chore: update Solidity version 0.8.19 -> 0.8.20

* format: format code

* chore: fix CI and update version

The CI failed because of imports, which are now corrected.

Next to this we decided to set the Solidity version to 0.8.23 because
it will be more up-to-date when we launch to mainnet

* Delete .gas-snapshot

* Update .gitignore

* Change TestsupportsInterface to only check immediate Iterfaces

---------

Co-authored-by: hieser <47272854+FHieser@users.noreply.github.com>
Co-authored-by: FHieser <felix_hieser@web.de>
…thub-ci-to-run-scripts

sc 126: update GitHub ci to run scripts
CI FIX: solved address collision in bc test
* chore: update OZ lib to V5

* chore: update openzeppelin to v5

- updated paths were needed
- added constructor arguments for Ownable update
- updated OZErrors and the expectRevert that were using them to work with
custom errors
- replaces Address.isContract with the logic it used, as it has been removed

* chore: update Solidity version 0.8.19 -> 0.8.20

* format: format code

* 394 metatransactions dev (#399)

* Modify ModuleManager to enact ERC2771

* Intermediate Push

I need to check something and pushing makes most sense he

* Fix inheritance to enable build

* Expose isTrustedForwarder in Orchestrator

* Implement modified ERC2771 to Module

* Fix Tests

A lot of modules havent  been properly initialized in the tests. The fix targets that by actually using the proxy Clone implementation and then properly  initializing them

* Add Module Test

* Implement MinimalForwarder

* Fix MakeFile

* Create E2ETest

* Add specific Role section in E2E Test

* Remove todo

* Marvin G Fix

* Foundryup formatting

* Fix after openZepplelin Update

* Create Transaction forwarder

* Update IModule.sol

* Change to Transaction forwarder

* chore: fix CI and update version

The CI failed because of imports, which are now corrected.

Next to this we decided to set the Solidity version to 0.8.23 because
it will be more up-to-date when we launch to mainnet

* WIP

* Fixing tests

* Cleanup

* Add Multicall Section into E2ETest

* Cleanup

* Merge fix

* Fix based on comments

* Delete .gas-snapshot

* Update .gitignore

* Change TestsupportsInterface to only check immediate Iterfaces

* Fix merge

* Create DeployAndSetUpTransactionForwarder.s.sol

* Add Transaction Forwarder Script to deployment scripts

---------

Co-authored-by: Zitzak <marvin88gr@gmail.com>
* Rename Contracts

* Refactor Beacons and add Version function

* Make it buildable

* Fix test

* Cleanup

* Update InverterBeacon.t.sol

* Update InverterBeacon.t.sol

* add BeaconProxy Test

* Clarify Outcommented

* Fix Beacon Upgrade Script

* Update UpgradeBeacon.s.sol

* Add Intervention Mechanism to InverterBeacon

* Make it buildable

* PR comment fix

* Add tests

* Add Interface

* Cleanup

* Move and update Beacon e2e

* Update InverterBeaconE2E.t.sol

* Cleanup

* Adapt naming

* Fix after merge
@marvinkruse marvinkruse added audit a feature needs auditing high prio labels Feb 29, 2024
@marvinkruse marvinkruse linked an issue Feb 29, 2024 that may be closed by this pull request
@marvinkruse marvinkruse marked this pull request as ready for review February 29, 2024 14:01
if (__Module_orchestrator.isTrustedForwarder(msg.sender)) {
// The assembly code is more direct than the Solidity version using `abi.decode`.
/// @solidity memory-safe-assembly
assembly {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should also verify calldatasize is more than 20 to be sure

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is better to use the ERC2771Context methods from OZ instead of writing your own, to avoid these kind of mistakes, toh here as in _msgData. You can override isTrustedForwarder easily

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did it as you recommended and inherited from ERC2771Context
I hope I did the inheritance correctly this time :3

@0xNuggan
Copy link
Contributor

Last change looks good to me. I still think maybe it's too verbose to declare the isTrustedForwarder in the Orchestrator itself only to overwrite it, but as we said it's just taste, and if it makes interactions from other Modules easier then so be it :)

@0xNuggan 0xNuggan merged commit 8e2f366 into dev Apr 12, 2024
@0xNuggan 0xNuggan deleted the review branch April 12, 2024 11:30
@marvinkruse marvinkruse restored the review branch April 12, 2024 11:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

audit a feature needs auditing high prio

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SC-191] Security Review - MetaTx/Multicall, Intervention + OZv5

5 participants